Routing from a 32 to an ASA

Hello

I move a range of clients from a few old network kit to a new network kit. They have a 24 wide public routed to their old firewall and this range will be moved and routed to the external interface of the ASA for their news. Everything is very simple. But they have a different ASA 5505 that they use for VPN connections that is the intellectual property within that 24, i.e. the external interface is in the network.

They asked me to move the 5505 before 24 is moved. Now I can't road only 32 to the device as it would require a default gateway of return within the same network path. However what I can do, is to introduce another one network 29, configure this with HSRP on routers upstream and change the external IP of the ASA to exist within this new network.

Then I could drive the old 32 IP to the new IP of the interface of the 5505 outside, provising transit.

So far, I feel that this will work because it is only a standard routed range for the firewall outside interface.

The problem is, the VPN that have been set up would work, as I see traffic is expected to reach the device, but the device will answer on the new outside interface IP... I'm guessing that the ASA remote would receive this traffic on the IP source address and VPN connections will fail.

Am I wrong? Please correct me and give me your grain of salt (or two pennys to the United Kingdom). Any help is appreciated, how do I get this to work...

Thank you

Hello

So, you ask if you can create a new network link for ASA5505 and the unique host IP route to the ASA with the next hop set to ASA IP address and then use this IP address to a single host for incoming VPN connections?

If yes then it seems to me that it is impossible. To my knowledge there is no way to assign any other address to accept VPN connections or any connection with the SAA itself IF the IP in question is not configured on the interface of the ASAs.

From what you say, it seems that you want to keep the same 24 public IP space even after migration.

Wouldn't the solution in this case, and expand the L2 segment of the device that keeps the door of entry for 24 of the network for the new ASA equipment ASA5505 connecting directly to the network with no connection network (29)?

-Jouni

Tags: Cisco Security

Similar Questions

  • Reset the router from WEP to WPA2

    How can I RESET my router from WEP to WPA2?

    Log in and change the WIRELESS security, see the manual

    http://www.downloads.NETGEAR.com/files/GDC/WNDR3400V2/WNDR3400v2_UM_23JAN2013.PDF

  • I GOT A NEW ROUTER FROM VERIZON ACTIONTEC GT784 INSTALLED BUT NOW CAN'T USE MY MX340 WIRELESS PRINTER HELP

    I GOT A NEW ROUTER FROM VERIZON ACTIONTEC GT784 INSTALLED BUT NOW MY PRINTER DOES NOT PRINT. MX340 WIRELESS PRINTER. CLOSE

    Hello

    To help you to propose measures to solve the problem, I would appreciate if you could answer the following question:

    1. what version of Windows operating system is installed on the computer?

    2 successful wireless connection configuration?

    3. do you receive an error message or error code when trying to print?

    In the meantime, I suggest to add the device on the network and check if that does the trick. To do this, follow these items:

    Connect to Bluetooth and other wireless or network devices

    http://Windows.Microsoft.com/en-us/Windows7/connect-to-Bluetooth-and-other-wireless-or-network-devices

     

    Add a device or computer to a network

    http://Windows.Microsoft.com/en-us/Windows7/add-a-device-or-computer-to-a-network

     

    Sharing of files and printers

    http://Windows.Microsoft.com/en-us/Windows/sharing-files-printers-help#sharing-files-and-printers=Windows-7&V1H=win8tab1&V2H=win7tab1&V3H=winvistatab1&v4h=winxptab1

    Hope this information helps. Reply with more information about the issue so that we can help you better.

  • Anyone know how long it will be before I can connect my Sony vaio vista to the router from the sky?

    I have just a Sony vaio with vista home premium laptop

    It will connect to my new router from Sky, but not to the internet

    can someone tell me how long it will be before the Microsoft fix this problem?

    its driving me crazy that he plugged in without problem on the old router from Sky

    I have no problem with my apple devices or just two other portable Windows vista it is a problem

    Hello! Have you tried contacting the support? Here's the phone number of the sky. Just call them and describe your problem. It could help you, I guess that

  • How to find the IP address of the router from my computer in Windows 7?

    What is the best way to find the IP address of the router from my computer in Windows 7? I know not how to make using the start > cmd > ipconfig, but is there a way to do it with just the mouse?

    Right click on the WiFi icon or-> LAN in the system tray click on open network and sharing Center-> click on "Wireless network connection"--> details click-> see item highlighted on the screenshot:

  • Internet works is not in LAN behind a router from Cisco 881

    My internet does not work in local network that is behind the router from Cisco 881. Here is the configuration of the router.

    Help, please...

    Current configuration: 1478 bytes
    !
    ! Last modification of the configuration at 08:16:12 UTC Wednesday, February 6, 2036
    !
    version 15.1
    no service button
    horodateurs service debug datetime msec
    Log service timestamps datetime msec
    no password encryption service
    !
    hostname R1
    !
    boot-start-marker
    boot-end-marker
    !
    enable secret 5 CATz $1$ $ VqnIsAQvFHHnV9E/Q6RMV0
    !
    No aaa new-model
    iomem 10 memory size
    !
    !
    IP source-route
    !
    !
    DHCP excluded-address IP 192.168.1.1
    !
    IP dhcp pool dhcppool1
    import all
    network 192.168.1.0 255.255.255.0
    default router 192.168.1.1
    DNS-server 202.56.230.2 202.56.230.7
    !
    !
    IP cef
    name of the IP-server 202.56.230.2
    name of the IP-server 202.56.230.7
    No ipv6 cef
    !
    !
    license udi pid CISCO881-K9 sn FGL1539254Q
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    !
    interface FastEthernet0
    !
    interface FastEthernet1
    !
    interface FastEthernet2
    !
    interface FastEthernet3
    !
    interface FastEthernet4
    IP 182.73.122.54 255.255.255.252
    NAT outside IP
    IP virtual-reassembly
    automatic duplex
    automatic speed
    !
    interface Vlan1
    IP 192.168.1.1 255.255.255.0
    IP nat inside
    IP virtual-reassembly
    !
    router RIP
    version 2
    network 192.168.1.0
    !
    IP forward-Protocol ND
    IP http server
    no ip http secure server
    !
    overload of IP nat inside source list 101 interface FastEthernet4
    IP route 0.0.0.0 0.0.0.0 182.73.122.53
    !
    access-list 101 permit ip 0.0.0.0 255.255.255.0 any
    !
    !
    !
    !
    !
    control plan
    !
    !
    Line con 0
    exec-timeout 5 30
    password vinayak123
    opening of session
    no activation of the modem
    line to 0
    line vty 0 4
    password vinayak123
    opening of session
    transport of entry all
    !
    end

    Hello @[email protected] / * /;
    Thank you for your message. I had a glance on the configuration for you. You used a network as opposed to a wild card mask in your access control list for your NAT statement. This changed the field from the source to 0.0.0.0 automatically, which is going to be does not match your interior traffic and NAT'ing outside.
    To fix this, please run the following commands and test once more.
    no access-list 101access-list 101 permit ip 192.168.1.0 0.0.0.255 any
    Thank you
    

    Luke
    

    


    

    Please evaluate the useful messages and mark the correct answers.
    		   
    •  
            
           
  •  
		     
    IPSec tunnel on router from closure
     
			 
    Is it possible to get a VPN IPSec tunnel on a router from the loopback interface? If so, how?
    			 
    Hello
    

    Yes it is possible. The command is:
    

    card crypto-address loopback
    

    Please make sure that the loopback interface has a public IP address that is accessible.
    

    http://www.Cisco.com/univercd/CC/TD/doc/product/software/ios124/124tcr/tsec_r/sec_c3ht.htm#wp1274324
    

    HTH,
    

    * Please rate if this helps,
    

    Kind regards
    

    Kamal
    		   
    •  
            
           
  •  
		     
    SSL VPN may be configured on the router from Cisco 881/K9?
     
			 
    I'm now confused if SSL VPN can be configured on the router from Cisco 881/K9.
    

    Please someone advise me.
    

    If Yes, for only 5 users, what I need to buy the license or license is supplied with the router?
    

    Thank you.
    			 
    Yes, and you need a license:
    

    FL-WEBVPN-10-K9
    

    License SSL VPN functionality for up to 10 users (incremental), to 12.4 T based only IOS versions
    

    FL-SSLVPN10-K9
    

    License SSL VPN functionality for up to 10 users (incremental) for the only based 15.x IOS versions
    		   
    •  
            
           
  •  
		     
    Launch a VPN from a cisco router on the LAN behind the ASA?
     
			 
    We currently have an ASA with used site to site VPN and anyconnect VPN. We received a third party cisco router that will be used to launch their own VPN site to site of inside our LAN to their local network through our ASA.
    

    1 NAT Traversal would call our ASA? 5540 (config) #crypto isakmp nat-traversal
    

    2. the ports listed below interfere with site to site VPN and anyconnect VPN ports?
    

    SSH
    

    -allow access of xxxxx on TCP Port 22
    

    ICMP
    

    -allow access of xxxxx - Protocol No. 1
    

    ISAKMP
    

    -allow access to xxxxx on UDP Port 500, also add UDP 4500 for NAT - T
    

    ESP
    

    -allow access to xxxxx - protocol 50
    

    Port of certificate:
    

    -allow access to xxxxx on port TCP 8080
    

    NTP port:
    

    -allow access to xxxxx on port UDP 123
    			 
    Hi Michael,
    

    1-
    

    NAT - T is only required if one of the sites is behind NAT.
    

    NAT - T allows to establish a connection through a NAT device counterparts IPsec. It does this by encapsulating IPsec datagrams UDP traffic, using the port 4500, which provides information of port NAT. NAT - T devices automatically detects all NAT devices and only encapsulates IPsec traffic when necessary. This feature is disabled by default.
    

    http://www.Cisco.com/en/us/docs/security/ASA/asa84/configuration/guide/vpn_ike.html#wp1120836
    

    2-
    

    ISAKMP
    

    -allow access to xxxxx on UDP Port 500, also add UDP 4500 for NAT - T
    

    ESP
    

    -allow access to xxxxx - protocol 50
    

    The ports above are those used for the IPsec VPN, SSL AnyConnect does not use them.
    

    Let me know.
    

    Thank you.
    

    Portu.
    

    Please note all messages that you be useful.
    

    Post edited by: Javier Portuguez
    		   
    •  
            
           
  •  
		     
    Routing issue of Cisco VPN Client ASA
     
			 
    Hi, I use a Barracuda NG for firewalls and I would use a Cisco ASA 5505 for VPN Client connections. But I have the problem that I can't get a connection to the VPN PC connected to the internal network. But I can reach the VPN connected PC from the inside. Here is a diagram of my network:
    


    Here the IP Configuration and the routing of the Barracuda firewall table:
    


    I have a route on the Barracuda NG to the 10.10.10.0/24 network VPN Client on eth0.
    

    The 192.168.1.0/24 LAN I ping the Client comes with Client VPN 10.10.10.11 as it should. But I can't ping or access network resources in the local network for AnyConnected customer's PC that connected through the VPN.
    

    Here is the config Cisco ASA:
    

     : Saved : : Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz : ASA Version 9.2(2) ! hostname leela names ip local pool VPN-Pool 10.10.10.10-10.10.10.200 mask 255.255.255.0 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 switchport access vlan 5 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! interface Vlan1 nameif inside security-level 100 ip address 192.168.1.250 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address dhcp ! interface Vlan5 nameif dmz security-level 50 ip address 172.16.0.250 255.255.255.0 ! ftp mode passive clock timezone CEST 1 clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00 dns domain-lookup inside dns server-group DefaultDNS name-server 192.168.1.10 same-security-traffic permit inter-interface same-security-traffic permit intra-interface object network obj_any subnet 0.0.0.0 0.0.0.0 object network VPN-Pool subnet 10.10.10.0 255.255.255.0 description VPN-Pool object network NETWORK_OBJ_10.10.10.0_24 subnet 10.10.10.0 255.255.255.0 access-list inside_access_in extended permit ip any any access-list inside_access_in extended permit ip object VPN-Pool any access-list dmz_access_in extended permit ip any any access-list global_access extended permit ip any any access-list outside_access_in extended permit ip any any pager lines 24 logging enable logging asdm informational mtu inside 1500 mtu outside 1500 mtu dmz 1500 no failover icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 no arp permit-nonconnected nat (inside,dmz) source static any any destination static NETWORK_OBJ_10.10.10.0_24 NETWORK_OBJ_10.10.10.0_24 no-proxy-arp route-lookup inactive access-group inside_access_in in interface inside access-group outside_access_in in interface outside access-group dmz_access_in in interface dmz access-group global_access global route dmz 0.0.0.0 0.0.0.0 172.16.0.254 1 route inside 0.0.0.0 0.0.0.0 192.168.1.254 tunneled timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy server-type microsoft user-identity default-domain LOCAL aaa authentication enable console LDAP_SRV_GRP LOCAL aaa authentication http console LDAP_SRV_GRP LOCAL aaa authentication ssh console LDAP_SRV_GRP LOCAL aaa authentication serial console LOCAL http server enable 444 http 192.168.1.0 255.255.255.0 inside snmp-server location Vienna crypto ipsec ikev2 ipsec-proposal DES protocol esp encryption des protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal 3DES protocol esp encryption 3des protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES protocol esp encryption aes protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES192 protocol esp encryption aes-192 protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES256 protocol esp encryption aes-256 protocol esp integrity sha-1 md5 crypto ipsec security-association pmtu-aging infinite crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map inside_map interface inside crypto map dmz_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map dmz_map interface dmz crypto ca trustpoint ASDM_TrustPoint0 enrollment self subject-name CN=leela proxy-ldc-issuer crl configure crypto ca trustpoint ASDM_TrustPoint1 enrollment terminal crl configure crypto ca trustpool policy crypto ca certificate chain ASDM_TrustPoint0 quit crypto ikev2 policy 1 encryption aes-256 integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 10 encryption aes-192 integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 20 encryption aes integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 30 encryption 3des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 40 encryption des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 enable dmz client-services port 443 crypto ikev2 remote-access trustpoint ASDM_TrustPoint0 telnet timeout 5 no ssh stricthostkeycheck ssh 192.168.1.0 255.255.255.0 inside ssh timeout 30 ssh key-exchange group dh-group1-sha1 console timeout 0 dhcpd auto_config outside ! dhcpd address 192.168.1.254-192.168.1.254 inside ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept dynamic-filter updater-client enable dynamic-filter use-database ntp server 192.168.1.10 source inside ssl trust-point ASDM_TrustPoint0 dmz ssl trust-point ASDM_TrustPoint0 inside webvpn enable dmz no anyconnect-essentials anyconnect image disk0:/anyconnect-macosx-i386-3.1.05170-k9.pkg 1 anyconnect image disk0:/anyconnect-win-3.1.05170-k9.pkg 2 anyconnect image disk0:/anyconnect-linux-3.1.05170-k9.pkg 3 anyconnect image disk0:/anyconnect-linux-64-3.1.05170-k9.pkg 4 anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml anyconnect enable tunnel-group-list enable group-policy DfltGrpPolicy attributes default-domain value group-policy GroupPolicy_AnyConnect internal group-policy GroupPolicy_AnyConnect attributes wins-server none dns-server value 192.168.1.10 vpn-tunnel-protocol ikev2 ssl-client webvpn anyconnect profiles value AnyConnect_client_profile type user group-policy portal internal group-policy portal attributes vpn-tunnel-protocol ssl-clientless webvpn url-list none username tunnel-group AnyConnect type remote-access tunnel-group AnyConnect general-attributes address-pool VPN-Pool authentication-server-group LDAP_SRV_GRP default-group-policy GroupPolicy_AnyConnect tunnel-group AnyConnect webvpn-attributes group-alias AnyConnect enable tunnel-group Portal type remote-access tunnel-group Portal general-attributes authentication-server-group LDAP_SRV_GRP default-group-policy portal tunnel-group Portal webvpn-attributes group-alias portal enable! ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 ! prompt hostname context no call-home reporting anonymous hpm topN enable : end no asdm history enable
    

    Can someone please help me solve this problem?
    

    When I tried to solve this I didn't choose which interface the Packet Tracer?
    

    The interface inside or DMZ interface?  Inside, he says it will not work with the dmz but the error did not help me
    

    Anyone here knows why it does not work?
    

			 
    Hello
    

    Inside LAN is directly connected to the right firewall VPN... then I don't think you have to have the itinerary tunnele... can you try to remove the road tunnel mode and check.
    

    entrance to the road that is static to achieve 10.10.10.11 as its display is correct...
    

    Route by tunnel watch also with 255 administrative distance.  I've never used that in my scenarios... lets see...
    

    Concerning
    

    Knockaert
    		   
    •  
            
           
  •  
		     
    Re-establish the connection to the router from Verizon Wireless
     
			 
    I use IE6 on a portable Toshiiba with Windows XP. Our internet connection is via a Verizon Wireless router. Today, I can't run (Firefox or IE, by the way) - it does not detect the router. I am still able to connect to this router and internet through my MacBook Pro. How do I reconnect?
    

    Thank you.
    			 
    Hello
    

    1. What is the model of the router?
    

    2. you get any error message?
    

    3. don't you make changes to the computer before the show?
    

    Please follow the steps below.
    

    Method 1:
    

    Follow the steps from the link below.
    

    http://support.Microsoft.com/kb/870702
    

    Method 2:
    

    Follow the steps from the link below.
    

    http://Windows.Microsoft.com/en-us/Windows/help/wired-and-wireless-network-connection-problems-in-Windows
    

    Method 3:
    

    Follow the steps from the links below.
    

    http://www22.Verizon.com/support/residential/Internet/fiosinternet/networking/setup/vzmi424/120519.htm#
    

    http://www22.Verizon.com/support/residential/Internet/fiosinternet/networking/setup/vzmi424/120527.htm
    

    See also the below mentioned link.
    

    http://www.Microsoft.com/athome/organization/wirelesssetup.aspx
    		   
    •  
            
           
  •  
		     
    Connect to Neflix using router from Verizon for TV
     
			 
    I have Verizon FIOS and use their router (Actiontec). I have a network that works well. Using the Wii I tried connect Netflix to my TV without success.
    			 
    Hello
    

    

    1. you are trying to read the Netfilx directly from the TV?
    2. the Netflix works on your computer?
    3. What is the exact error message and the error code?
    4. it worked before?
    

    

    See the Microsoft article and check if that helps.
    

    
    
    Limitations of Netflix on Windows Media Center for Windows Vista and known issues: http://support.microsoft.com/kb/972496

    
		   
    •  
            
           
  •  
		     
    Adding a new wireless router from Linksys at an old Linksys router system
     
			 
    Hello
    

    I'll install a new standalone DVR to a home video surveillance system.  I would like to be able to access it with my current PC so I would like to add a Linksys wireless router.
    

    I'm currently 1 Linksys Wireless - G Broadband Router with speed Booster model WRT54GS-BP and 2 models WMP54GS from PC that have PCI adapters Wireless-G with speed Boosters (802.11 g).  I had these installed since 2006 and although they are no longer supported I really want to have to upgrade because they work very well.
    

    My questions are:
    

    If I add a new Linksys router to my new DVR will be able to communicate with my older Linksys router and adapters?   If Yes, what would be the best new router Linksys type should I buy?
    

    Thanks in advance for any help and advice.
    			 
    Hi Dan,.
    

    Please excuse the delay of time here, but I had a hard time to post a reply.  I added Ethernet Wireless-N - WET610N bridge.  When I installed the software, I kept getting error 102 - an error occurred communicating with your device.  I called Linksys for help and the tech had me make a few changes to the router 192.168.1.1.  I was able to install the Web Service to display the camera on both of our PC.  So the addition of the WET610N allowed us to access the DVR wireless!
    

    Thanks a lot for all your help!
    		   
    •  
            
           
  •  
		     
    Issues connecting to a router from Draytek L3 SG500-28
     
			 
    Hi all
    

    I really struggle with this one. I have a SG 500-28 L3 switch with a link to trunk work to two other L2 switches. I am trying to allow guests in VIRTUAL LANs for access to the outside world... the L3 switch is connected to a router Draytek. I have assigned an IP address to one of the ports and set routing in both directions of L3 to the router. I can ping from the L3 switch to the router and the router to the L3 switch, but no host in any VLAN only can ping more far than the interface IP 192.168.254.253. Can anyone help with this? Is there something specific in this switch I'm missing? IP routing is enabled on the L3 switch.
    

    The L3 config is here:
    

    switch8abb2b
    

    v1.2.7.76 / R750_NIK_1_2_584_002
    

    CLI v1.0
    

    SSD of encrypted file indicator
    

    @
    

    SSD-control-start
    

    config of SSD
    

    control of password file unrestricted SSD
    

    no control of the integrity of the file ssd
    

    SSD-control-end cb0a3fdb1f3a1af4e4430033719968c0
    

    !
    

    database of VLAN
    

    VLAN 10,20,30,100
    

    output
    

    Add a voice vlan Yes-table 0001e3 Siemens_AG_phone___
    

    Add a voice vlan Yes-table 00036 b Cisco_phone___
    

    Add a voice vlan Yes-table 00096e Avaya___
    

    Add a voice vlan Yes-table 000fe2 H3C_Aolynk___
    

    Add a voice vlan Yes-table 0060 b 9 Philips_and_NEC_AG_phone
    

    Add a voice vlan Yes-table 00d01e Pingtel_phone___
    

    VLAN voice Yes-table add Polycom/Veritel_phone___ 00e075
    

    Add a voice vlan Yes-table 00e0bb 3Com_phone___
    

    Hello interface range vlan 1
    

    hostname switch8abb2b
    

    username privilege 15 0c4d0931711a0e9cb22337c1adbe39091ad15a73 encrypted password cisco
    

    !
    

    interface vlan 1
    

    IP 192.168.1.230 255.255.255.0
    

    no ip address dhcp
    

    !
    

    interface vlan 10
    

    Name SERVERS
    

    IP 10.0.10.254 255.255.255.0
    

    !
    

    interface vlan 20
    

    DISTRICTS of name
    

    IP 10.0.20.254 255.255.255.0
    

    !
    

    interface vlan 30
    

    name of LABORATORY
    

    IP 10.0.30.254 255.255.255.0
    

    !
    

    interface vlan 100
    

    name ITECH
    

    IP 192.168.12.254 255.255.255.0
    

    !
    

    interface gigabitethernet1/1/1
    

    switchport trunk allowed vlan add 10,20,30,100
    

    default switchport vlan tagged
    

    !
    

    interface gigabitethernet1/1/24
    

    IP 192.168.254.253 255.255.255.0
    

    !
    

    IP route 0.0.0.0 0.0.0.0 192.168.254.254
    

    The draytek routing table is here:
    

    Key: C - connected, S - static, R - RIP, *-default, ~-private
    

    * 0.0.0.0 / 0.0.0.0 via 172.16.0.1 WAN2
    

    S ~ 10.0.0.0 / 255.255.0.0 via 192.168.254.253 LAN1
    

    S ~ 192.168.12.0/ 255.255.255.0 via 192.168.254.253 LAN1
    

    S ~ 192.168.1.0/ 255.255.255.0 via 192.168.254.253 LAN1
    

    C ~ 192.168.254.0/ 255.255.255.0 directly connected to LAN1
    

    C 172.16.0.0/ 255.255.0.0 directly connected WAN2
    

    I am also getting this error periodically on the L3 switch. Not sure if it is related to the problem.
    

    switch8abb2b # 19 July 2012 18:37:27 % CDP-W-NATIVE_VLAN_MISMATCH: incompatibility of VLAN native detected on the interface item in gi1/1/1.
    

    Any help would be greatly appreciated!
    

    Chris
    			 
    Hi Chris, the problem seems to be the router. It does not support interface trunk/sup dot1q or it back pointing you are missing the static routes, to the SVI to the switch.
    

    -Tom
    Please mark replied messages useful
    		   
    •  
            
           
  •  
		     
    VPN router to the problem of the ASA
     
			 
    Hello world.
    

    I am doing a VPN between a router and a series of ASA5500 and difficulties.
    

    The router part is 100% correct because it is a daily task, but miss me something on the side of the ASA of the things.
    

    The ASA also has remote via IPsec tunnels clients as you'll see below, so I have to make sure that continues to work!
    

    It is a fairly urgent question. So any help or advice can be provided, it would be very appreciated!
    

    Here is the router part:
    

    !
    

    crypto ISAKMP policy 1
    

    BA 3des
    

    preshared authentication
    

    Group 2
    

    isakmp encryption key * ASA-PUBLIC-IP address
    

    ISAKMP crypto keepalive 100
    

    !
    

    !
    

    Crypto ipsec transform-set transform-set esp-3des esp-md5-hmac
    

    !
    

    10 customers map ipsec-isakmp crypto
    

    defined ASA-PUBLIC-IP peer
    

    transform-set transform-Set
    

    match address 102
    

    QoS before filing
    

    !
    

    !
    

    Access-list 100 remark [== NAT control ==]
    

    access-list 100 deny ip 192.168.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    

    access-list 100 permit ip 192.168.2.0 0.0.0.255 any
    

    Access-list 102 remark == [VPN access LISTS] ==
    

    access-list 102 permit ip 192.168.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    

    Access-list 102 remark
    

    (Crypto card has been applied to the corresponding interface)
    

    SIDE OF THE ASA:
    

    permit inside_nat0_outbound to access extended list ip 10.1.1.0 255.255.255.0 10.1.1.192 255.255.255.224
    

    prevpn_splitTunnelAcl list standard access allowed 10.1.1.0 255.255.255.0
    

    access-list Interior-access-in extended permit ip 10.1.1.0 255.255.255.0 any
    

    access-list Interior-access-in extended permit icmp 10.1.1.0 255.255.255.0 any
    

    access list for distance-extended permitted ip network 10.1.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    

    Global (outside) 1 ASA-PUBLIC-IP
    

    NAT (inside) 0-list of access inside_nat0_outbound
    

    NAT (inside) 1 10.1.1.0 255.255.255.0
    

    NAT (inside) 0 192.168.2.0 255.255.255.0
    

    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
    

    Crypto-map dynamic outside_dyn_map 20 the transform-set ESP-3DES-MD5 value
    

    card crypto outside_map 40 match remote-network address
    

    card crypto outside_map 40 game peers REMOTE-router-IP
    

    outside_map card crypto 40 the transform-set ESP-3DES-MD5 value
    

    map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map
    

    outside_map interface card crypto outside
    

    ISAKMP allows outside
    

    part of pre authentication ISAKMP policy 10
    

    ISAKMP policy 10 3des encryption
    

    ISAKMP policy 10 md5 hash
    

    10 2 ISAKMP policy group
    

    ISAKMP life duration strategy 10 86400
    

    tunnel-group prevpn type ipsec-ra
    

    tunnel-group prevpn General-attributes
    

    address pool VPN-pool
    

    Group Policy - by default-prevpn
    

    prevpn group of tunnel ipsec-attributes
    

    pre-shared-key *.
    

    tunnel-group REMOTE-router-IP type ipsec-l2l
    

    REMOTE-router-IP tunnel-group ipsec-attributes
    

    pre-shared-key *.
    			 
    Hi Chris
    

    first on the router make this change to littil than u ned to add md5 as hashing whil employees u th in the asa and the router u did not, so the default is sha!
    

    do
    

    crypto ISAKMP policy 1
    

    md5 hash
    

    now on the SAA as I see that there is a problem in nat0 you line l2l tunnel
    

    so that you need to look like:
    

    permit inside_nat0_outbound to access extended list ip 10.1.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    

    You also need a permit for the ipsec traffic, the following command will allow all ipsec traffic if you want to filter traffic not to use this command and use rather ACLs on the external interface, but following that to allow all traffic to your L2L and remote vpn access:
    

    Permitted connection ipsec sysopt
    

    so, please:
    

    clear xlate and reload the ASA then attempt to leave the expmtion NAT new effects
    

    Good luck
    

    If useful rates
    		   
    •  
          
 
         
 
        
 
		
 
          
Maybe you are looking for